Cloudanix VulnDB

CVE-2025-68204

None

CVSS

—

EPSS

0.2%

Published

Dec 16, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux power-management code can leak memory during startup and cause the computer to crash if certain hardware setup steps fail.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Failure of of_genpd_add_provider_onecell during SCMI power domain provider probe leaves previously allocated generic power domains resident, resulting in a memory leak that can trigger a kernel paging fault in genpd_debug_add during later initialization.

Why it matters to the business

Affected Linux-based systems, including container images used by GitLab deployments, may experience boot-time instability or crashes, increasing operational risk and requiring urgent patching of the kernel components in those images.

How an attack unfolds

An attacker with the ability to induce or simulate failure of the SCMI one-cell provider registration (for example via crafted device-tree or hardware configuration) can trigger the missing cleanup path, exhausting memory or causing a crash in genpd_debug_init; the low EPSS and lack of known threat actor use indicate this path is not practically weaponized.

How to fix it

Update the Linux kernel to commit 18249a167ffd91b4b4fbd92afd4ddcbf3af81f35 or later; for Chainguard images apply the listed fixed versions (gitlab-cng-fips-17.8 and related packages at 17.8.2-r0 or newer) and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 18249a167ffd91b4b4fbd92afd4ddcbf3af81f35, verify that SCMI power-domain probe failures now correctly release allocated domains, and test that genpd_debug_init completes without paging faults on the target hardware.

Typical attack path

  1. Gain control over device-tree or hardware configuration presented to the SCMI driver during probe
  2. Force of_genpd_add_provider_onecell to return an error after domains have been created
  3. Allow kernel initialization to reach genpd_debug_add without the leaked domains having been removed
  4. Trigger the resulting invalid memory access leading to kernel crash or resource exhaustion

How to detect it

Review kernel boot logs and dmesg for messages indicating SCMI provider registration failure followed by genpd_debug_add faults; examine initcall traces for PID 1 crashes referencing genpd_debug_init.

What your security team should do

  • Prioritize patching of all listed Chainguard GitLab images and Linux kernel packages to the supplied fixed versions within the next maintenance window
  • Monitor boot logs for genpd-related errors on systems using SCMI
  • Re-test hardware configurations that previously exercised the SCMI provider registration path after the update

The record

In the Linux kernel, the following vulnerability has been resolved: pmdomain: arm: scmi: Fix genpd leak on provider registration failure If of_genpd_add_provider_onecell() fails during probe, the previously created generic power domains are not removed, leading to a memory leak and potential kernel crash later in genpd_debug_add(). Add proper error handling to unwind the initialized domains before returning from probe to ensure all resources are correctly released on failure. Example crash trace observed without this fix: | Unable to handle kernel paging request at virtual address fffffffffffffc70 | CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : genpd_debug_add+0x2c/0x160 | lr : genpd_debug_init+0x74/0x98 | Call trace: | genpd_debug_add+0x2c/0x160 (P) | genpd_debug_init+0x74/0x98 | do_one_initcall+0xd0/0x2d8 | do_initcall_level+0xa0/0x140 | do_initcalls+0x60/0xa8 | do_basic_setup+0x28/0x40 | kernel_init_freeable+0xe8/0x170 | kernel_init+0x2c/0x140 | ret_from_fork+0x10/0x20

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.17.0 5.4.302
Mageia:9 kernel 0 6.6.120-1.mga9
Mageia:9 kernel-linus 0 6.6.120-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.14-14.mga9
Mageia:9 kmod-xtables-addons 0 3.24-88.mga9

Related vulnerabilities